Background on CIS Controls, Standards, and Governance GCCC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which statement best describes the historical origin of the CIS Critical Security Controls?

   • AThey were developed by a consortium of government, industry, and academic experts to address the most common attacks observed in real-world data
   • BThey were created by a single commercial vendor to promote its own security products
   • CThey were designed exclusively for government agencies and are not applicable to private-sector organizations
   • DThey were first published by the International Organization for Standardization (ISO) as an international standard
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A multinational corporation operates in multiple jurisdictions with differing data protection regulations. The board has mandated that the cybersecurity program align with the CIS Controls, but the legal team is concerned about regulatory conflicts. The CISO must integrate the CIS Controls into the governance framework while satisfying diverse compliance requirements. Which approach best addresses this challenge?

   • AImplement only the CIS Controls that are explicitly required by the strictest regulation and ignore others.
   • BAdopt a single regulatory framework, such as GDPR, for all jurisdictions to simplify compliance.
   • CMap each CIS Control to the relevant regulatory requirements in each jurisdiction and prioritize controls that address the most stringent obligations.
   • DUse the CIS Controls only for internal reporting and rely on external auditors for regulatory compliance.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A financial services firm is required to comply with multiple regulations and also wants to demonstrate due diligence to its board. They currently use ISO 27001 for their management system and are considering adopting the CIS Controls. The compliance officer asks whether the CIS Controls are necessary if they already have ISO 27001. What is the best response?

   • AThe CIS Controls provide specific technical safeguards that can help meet the control objectives of ISO 27001 and strengthen evidence for compliance.
   • BThe firm should abandon ISO 27001 and adopt the CIS Controls instead, since they are more recognized by regulators.
   • CISO 27001 already covers all technical controls, so the CIS Controls are redundant and unnecessary.
   • DThe CIS Controls are only for organizations that do not have ISO 27001 certification.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A city government is developing a cybersecurity strategy. The mayor's office wants to ensure that security decisions are made with input from department heads and align with the city's risk tolerance. Which action best demonstrates cybersecurity governance?

   • AEstablish a steering committee that reviews risk assessments and approves security priorities based on the city's objectives.
   • BAdopt the CIS Controls without any review, since they are a recognized best practice.
   • CPurchase the most advanced security tools available to demonstrate commitment to cybersecurity.
   • DLet the IT department make all security decisions, since they have the technical expertise.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A mid-sized e-commerce company with a dedicated security team of five is implementing CIS Controls v8. They have moderate risk exposure and handle customer payment data. According to the Implementation Group model, which set of safeguards should they prioritize after completing IG1?

   • AIG2 safeguards, which add protections for organizations with more resources and higher risk exposure.
   • BIG3 safeguards, because handling payment data automatically requires the highest implementation group.
   • CA random selection of IG2 and IG3 safeguards based on vendor recommendations.
   • DOnly IG1 safeguards, since they cover all common attacks and are sufficient for any organization.
   Reveal Solution Discussion Select an answer first